Internal Splunk User Stats

This simple Splunk query will show us unique Splunk user logged into Splunk per day, as well as total count of log-ons.

Continue Reading →

Hosts Taking a Long Time to Scan – Qualys

The following Splunk query will show the hosts taking an abnormally lengthy time to scan (helps find that needle in a haystack) within the Qualys Sourcetype:

I take no credit for this. These queries were discovered on Tarun Kumar’s blog.

Continue Reading →

How to Check When Splunk is finished Indexing a log file

How can I tell when Splunk is finished indexing a log file? (Credit for this one goes to author who originally posted it on his website) By watching ¬†data from splunk’s metrics log in real-time. ************************************************************

************************************************************ or to watch everything happening split by sourcetype…. ************************************************************

************************************************************ And if you’re having trouble […]

Continue Reading →

Total Number of Hosts reporting in.

This query will list the total number of hosts reporting to the indexer for any specified time range. This only works for universal forwarders. If you have hosts reporting in over syslog (typically port 514) they will not be listed.

Continue Reading →

Detailed list of Universal Forwarders Reporting to Indexer

The following query will list in detail information on the universal forwarders checking into the indexer. I’ve renamed some of the fields to be more user-friendly.

Continue Reading →